# Exploiting Redash instances with CVE-2021-41192

Redash fell back to a static Flask SECRET_KEY, letting attackers forge itsdangerous password-reset tokens for user ID 1 and take over admin accounts.

- Payout: $90,000
- Severity: critical
- Program: -
- Credited: Ian Carroll, Tuan Anh Nguyen, Gal Nagli
- Disclosed: 2022-01-06
- CVE: CVE-2021-41192, CVE-2021-43780
- Write-up quality: 8/10
- Original: https://ian.sh/redash
- Library page: https://bugbountylibrary.com/r/blog%3Aian-sh-redash
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:blog sev:critical tech:python technique:parser-differential technique:source-review vuln:account-takeover vuln:auth-bypass vuln:misconfiguration vuln:ssrf

**Target:** Self-hosted Redash web app (Flask session + password reset endpoint)
**Root cause:** Redash silently falls back to a hardcoded default SECRET_KEY when none is configured; the same key signs both Flask sessions and itsdangerous password-reset tokens keyed on auto-incrementing user IDs.
**Steps:**
1. Identify Redash instance and confirm default SECRET_KEY `c292a0a3aa32397cdb050e233733900f` via Flask-Unsign/CookieMonster wordlist.
2. Forge reset token: `URLSafeTimedSerializer("c292a0a3aa32397cdb050e233733900f").dumps(str("1"))` -> `IjEi.YdEknw.htZVzELmilJCgsSYu1oMXXEVhWY`.
3. GET `/reset/<token>`; vulnerable instances return `Enter your new password`.
4. Set new password for user 1 (admin) and log in.
5. Escalate: create URL data source with `http://169.254.169.254\@8.8.8.8` to bypass is_private_address and reach AWS metadata (CVE-2021-43780).
**How found:** Prior Airflow stateless-session finding led to running Flask-Unsign on scanned cookies; a Slack alert flagged a vulnerable cookie, source review revealed the static SECRET_KEY fallback and that reset tokens use the same key with sequential user IDs instead of UUIDs.
**Exploitation:** Attacker forges a valid itsdangerous reset token for user ID 1 using the known default secret key, visits /reset/<token>, sets a new admin password, logs in, and queries connected data sources; optionally adds a URL data source pointing at 169.254.169.254 to steal cloud metadata credentials.
**Escalation:** Admin access to Redash yields access to connected SQL data sources; chained with CVE-2021-43780 SSRF (urllib vs requests hostname parsing differential) to reach internal/metadata endpoints.
**Insight:** When a framework secret key leaks, don't stop at session forgery: grep for other itsdangerous/URLSafeTimedSerializer uses (password reset, invites, email confirmations) that may key on sequential IDs rather than UUIDs, making forgery trivial.